fix(review): reconcile labels from completed review receipts

[goutamadwant]

Closes #1226

An exact re-review can publish a current verdict but leave the old status, rating, proof, and merge-risk labels behind. The freshness check compared activity with the older item snapshot even when the completed review had already captured that discussion.

Use the existing complete source, timeline, head, and review-activity receipts to admit label reconciliation. All receipts must still match, and a complete activity read must show no substantive human activity in or after the review-completion second. Rounding a millisecond timestamp down to GitHub's whole second preserves that boundary. Legacy and close-proposal handling remain on their existing paths.

The implementation adds ten production lines and reuses the existing publication fixture. Historical standalone proof scaffolding is removed from this proposal. Original contributor credit is preserved for @goutamadwant.

Behavior proof

Ran the built production apply/publication command with identical controlled GitHub inputs before and after, intercepting all external I/O. This exercises the real freshness, receipt, publication, and label-batching code without changing a live item's labels.

Scenario	Before	After
Completed review captured discussion and re-review command	Verdict updated; stale labels remain	One batch replaces stale managed labels
Substantive human activity in the same second as review completion	No label update	No label update
Changed source receipt	No label update	No label update

The comparison uses Node 24.20.0 and the same pinned fixture inputs; only valid lease wall-clock timestamps and isolated paths differ. It proves the stale-label fix and the preserved negative controls. It does not claim that current main overwrites labels in those negative cases.

Real GitHub owner-boundary proof

Tested c3f3db1d6664d076313643d019110aef88399772 with Node 24.20.0 against disposable draft #1334 (fixture head 0c61c2fef38150b1cfceda89c5e3661b6bd0cf4b). GitHub reads, label mutations, timeline events, and readbacks were real. Only local review metadata, desired labels, and completion barriers were synthetic; no fabricated Codex verdict was published and no production apply/close lane was run.

The harness imported the actual createApplySourceFreshness, live collectItemContext, and existing status/rating sync plus batch-flush owners. Its runtime adapter appended exports to the unchanged compiled module. The first-parent freshness function evaluated the same captured GitHub context for comparison.

Scenario	Actual evidence, September 1 UTC	Observed result
Captured discussion	Ordinary fixture comment at 09:32:12Z; local synthetic completion 09:32:38.261Z. Production write returned 09:33:14.361Z.	Matching complete receipts: first-parent gate rejected; current gate admitted exactly one label batch. GitHub readback changed needs-proof/silver to ready-for-maintainer/diamond.
Same-second human labels	Event30336134204 and event30336134245, actor steipete, at 09:34:22Z. The actual write returned 09:34:22.962Z; that unmodified recorded time became the local synthetic completion barrier.	Complete receipts matched, but gate rejected. Owner invoked=false; zero owner writes. Human needs-proof/silver labels remained, although the owner target was ready/diamond. First timing attempt succeeded; timestamps were not rewritten.
Later human labels	Local synthetic completion 09:35:53.666Z; event30336220076 and event30336220129, actor steipete, at 09:36:00Z; write returned 09:36:01.317Z.	Complete receipts matched, but gate rejected. Owner invoked=false; zero owner writes; readback unchanged. This checks admission: these later labels already matched the owner's desired labels.

Positive mutation trace (one production batch; no repository label definitions changed):

gh --repo openclaw/clawsweeper issue edit 1334
  --add-label "rating: 🦞 diamond lobster,status: 👀 ready for maintainer look"
  --remove-label "rating: 🦪 silver shellfish,status: 📣 needs proof"
started:   2026-09-01T09:33:10.615Z
completed: 2026-09-01T09:33:14.361Z
exit: 0

GitHub recorded the positive replacement at 09:33:13Z as events 30336073929, 30336073947, 30336073962, and 30336074011.

All three captured contexts had matching source revision 5639c4ed6a9e4e747b034c3bd3655d8b487715181b1a5122694d201116f2f236, timeline revision 086c7cd69c5779af227fd86bfddfae28b7f1adad6d8af85eed085cae8482863b, and v2 activity cursor v2:0:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945. This demonstrates why matching receipts still need the separate human-activity time guard for managed-label events.

The forwarding recorder initially truncated a large check-runs response because it exited after an asynchronous stdout write. Only the recorder was corrected to synchronous fd writes; subsequent complete control reads succeeded. The diagnostic is retained as a harness limitation, not a ClawSweeper/GitHub defect. This proof covers the selected owners and real GitHub transport; it does not claim Codex inference, distributed lease/queue behavior, full-lane execution, or a merge test.

Cleanup is verified: original empty labels restored, fixture 1334 closed at 09:39:18Z, and its task-created remote branch deleted. The fixture was never merged.

Validation

Build, eight focused tests, targeted format/lint, and diff checks pass. Focused coverage also rejects changed timeline receipts, changed heads, later human activity, and close proposals. Managed Codex review is scoped-clean at P0. Full CI, sparse repair builds, and Windows launcher passed at https://github.com/openclaw/clawsweeper/actions/runs/33490397445; CodeQL passed at https://github.com/openclaw/clawsweeper/actions/runs/33490397519.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 1, 2026, 5:49 AM ET / 09:49 UTC.

ClawSweeper review

What this changes

The PR lets completed exact reviews reconcile managed status, rating, proof, and merge-risk labels when their source, timeline, head, and activity receipts still match.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This is a viable, focused fix for the still-open label-reconciliation issue, with no discrete correctness blocker found and sufficient current-head real GitHub transport proof.

Priority: P1
Reviewed head: c3f3db1d6664d076313643d019110aef88399772

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong real transport evidence and focused controls support a bounded, well-integrated automation fix.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.
Evidence reviewed	5 items	Receipt-gated reconciliation: The changed freshness path requires a completed non-close PR review, a fresh reviewed head, matching complete source/timeline/activity receipts, and no non-automation activity from the review-completion second onward before labels may sync. Human activity guard: The existing activity predicate checks complete comments, review comments, and timeline events and treats activity strictly after the supplied boundary as blocking; the new call uses one millisecond before the rounded review second. Focused regression coverage: The publication fixture covers the admitted captured-discussion case plus same-second activity, changed source receipt, changed timeline receipt, and changed head controls.
Findings	None	None.
Security	None	None.

How this fits together

ClawSweeper publishes completed Codex reviews to GitHub and derives managed PR labels from those reports. The freshness gate sits between the durable review record and the batched GitHub label mutation, preventing stale reviews or later human activity from changing routing labels.

flowchart LR
A[Completed review record] --> B[Receipt matching]
B --> C[PR head and activity check]
C --> D[Human activity safeguard]
D --> E[Managed label batch]
E --> F[GitHub PR routing labels]

Loading

Before merge

• Resolve merge risk (P1) - This changes automatic GitHub label writes, so the receipt-equality and whole-review-second human-activity guard must remain intact to avoid overriding human routing labels.
• Complete next step (P2) - No mechanical repair remains; this PR needs normal maintainer merge review with its current proof and safeguards.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Pinned-base range	128 files, +9,447/-4,456	The base-range listing is broad and truncated, but merge ancestry shows the reviewed merge commit incorporates shared main history; the label-reconciliation behavior is concentrated in the freshness gate and its fixture.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #1226
Summary: This PR directly implements the stale managed-label behavior described by the linked open issue.

Members:

• canonical: Exact re-review can publish a maintainer-ready verdict while PR status/rating labels remain stale #1226 - The PR body uses closing syntax and its receipt-based label-reconciliation behavior addresses that issue's reported divergence.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Merge with the verified freshness guard (recommended)
   Accept the bounded automation risk because the exact-head transport trace and focused controls show one admitted label batch while same-second and later human activity produce no owner write.

Technical review

Best possible solution:

Land the receipt-based reconciliation while retaining complete receipt equality and the conservative same-second human-activity rejection.

Do we have a high-confidence way to reproduce the issue?

Yes, at high confidence: the focused fixture establishes the receipt-matched stale-label path and the PR body records a current-head real GitHub transport run with positive and no-op controls.

Is this the best way to solve the issue?

Yes. Reusing the existing freshness and receipt machinery is the narrowest maintainable repair, and the added second-precision guard preserves the human-activity boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e038329b3fb1.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P1: Stale managed labels can hide a PR that is ready for maintainer review, affecting an active maintainer-routing workflow.
• merge-risk: 🚨 automation: The PR changes the admission condition for batched GitHub label mutations after completed reviews.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the apply lane's label-freshness gate; the current-head trace exercises it through real GitHub reads, one real managed-label batch and event readback, then demonstrates no owner write for same-second and later human activity. Local review metadata and desired labels are explicitly synthetic, which is an appropriate limit for this owner-boundary proof.

Evidence

What I checked:

• Receipt-gated reconciliation: The changed freshness path requires a completed non-close PR review, a fresh reviewed head, matching complete source/timeline/activity receipts, and no non-automation activity from the review-completion second onward before labels may sync. (src/clawsweeper-apply-source-freshness.ts:297, c3f3db1d6664)
• Human activity guard: The existing activity predicate checks complete comments, review comments, and timeline events and treats activity strictly after the supplied boundary as blocking; the new call uses one millisecond before the rounded review second. (src/clawsweeper-promotion-facts.ts:303, c3f3db1d6664)
• Focused regression coverage: The publication fixture covers the admitted captured-discussion case plus same-second activity, changed source receipt, changed timeline receipt, and changed head controls. (test/apply-label-sync.test.ts:2531, c3f3db1d6664)
• Current-head transport proof: The PR body records a real GitHub read, label mutation, event readback, same-second rejection, later-activity rejection, and fixture cleanup against this exact head; the synthetic inputs are explicitly limited to local review metadata and desired labels. (c3f3db1d6664)
• History and merge topology: The reviewed head is a merge whose first parent is the current review-automation baseline and whose second parent carries the original contributor fix; the fetched main and reviewed head share the first parent, so the large pinned-base range includes already-common history rather than a separate 128-file feature proposal. (src/clawsweeper-apply-source-freshness.ts:289, c3f3db1d6664)

Likely related people:

• PollyBot13: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-08-24T18:13:36.413Z sha 22735db :: needs real behavior proof before merge. :: [P2] Include the close-proposal regression in the proof script
• reviewed 2026-08-24T18:55:22.611Z sha 22735db :: needs real behavior proof before merge. :: [P2] Include the close-proposal guard in the proof command
• reviewed 2026-08-25T02:10:38.378Z sha e899469 :: needs real behavior proof before merge. :: [P1] Preserve the post-snapshot human-activity guard
• reviewed 2026-08-25T05:48:22.821Z sha a5d575f :: needs real behavior proof before merge. :: none
• reviewed 2026-08-31T04:28:12.327Z sha cff385b :: needs real behavior proof before merge. :: none
• reviewed 2026-08-31T11:06:47.075Z sha cff385b :: needs real behavior proof before merge. :: none
• reviewed 2026-09-01T03:46:14.720Z sha cff385b :: needs real behavior proof before merge. :: none
• reviewed 2026-09-01T09:09:44.825Z sha c3f3db1 :: needs real behavior proof before merge. :: none

[goutamadwant]

Added the requested real-transport trace. It shows label reconciliation through the GitHub API and verifies that both same-second and later human activity prevent the automated action. The trace was captured against the current head without changing the implementation.

[steipete]

@clawsweeper re-review

The PR body now includes real GitHub transport proof against head c3f3db1d6664d076313643d019110aef88399772, with inspectable timeline events from #1334. The positive case sent one production label batch; same-second and later human activity rejected admission with matching receipts and zero owner writes. The local review metadata is explicitly synthetic, and the later-label control's limit is documented. The disposable fixture is closed, labels restored, and its branch deleted.

Full CI and CodeQL are green. No product source changed during the additional proof.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33494415057
• Updated: 2026-09-01T09:51:56.877Z